CVE Vulnerability Catalog

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation; the stored XSS is triggered only during validation by the administrator.

In MCP TypeScript SDK from version 1.24.0 to before 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks.

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Prior to ApostropheCMS 4.33.0 and import-export 3.7.0, import routes invoke bigUploadMiddleware without an early authorize callback. Unauthenticated requests can perform upload initialization, chunk storage, temporary processing and attacker-declared cleanup work before the later user check rejects the import.

Prior to db-connect 1.1.0 and ApostropheCMS 4.33.0, an account with view-draft access can submit a projection exclusion path that traverses a constructor prototype chain to a shared prototype member when a SQLite, PostgreSQL or multipostgres adapter is used. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected.

A vulnerability in follow-redirects (versions 1.16.0 to before 1.16.1) causes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, sensitiveHeaders) not to be stripped when following a cross-host or protocol-downgrade redirect if the application supplied headers as an alternating array of names and values. The removal routine uses for...in, which yields numeric indices for arrays, so no header name matches the filter and nothing is removed. As a result, the application forwards credentials to an attacker-controlled destination without any error or warning.

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range.

A ThreadX module chooses object_size when it calls txm_module_object_allocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txm_module_object_deallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Apache CouchDB 3.5.2 and below contains an unlimited gzip decompression routine in chttpd. Any remote client can cause a denial of service via memory exhaustion.

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass in BasicAuthHandler. An attacker can log in as an LDAP/AD-delegated user by sending a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind accepted as successful authentication.

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import. An attacker can supply a crafted font whose wasm module places the output buffer near the end of linear memory, writing glyph-name bytes into host memory and crashing or corrupting applications.

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files via malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.